@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/dist/src/commands/attack-sim.js

@@ -0,0 +1,220 @@
+import { readFile } from "node:fs/promises";
+import { extractObservatoryFindings } from "../findings.js";
+import { runTarget } from "../index.js";
+import { renderAttackSimulationMarkdown } from "../reporters/attack-sim.js";
+import { renderSarif } from "../reporters/sarif.js";
+import { buildEvent, normalizeCampaign, recordEvent } from "../telemetry.js";
+import { validateRunArtifact } from "../validate.js";
+import { renderActionReceipt } from "../action-receipt.js";
+import { maybePrintCloudCta } from "../commercial.js";
+import { ANSI, c, getBinName, quoteShell, resolveTarget, targetFromCommand, writeOutput } from "./helpers.js";
+import { maybeConvertPassingCheckToCi } from "./setup-ci-conversion.js";
+function extractTrailingAttackFlags(commandArgs, options) {
+    const flags = { ...options };
+    const targetArgs = [];
+    for (let i = 0; i < commandArgs.length; i += 1) {
+        const arg = commandArgs[i];
+        const assign = arg.match(/^(--baseline|--json|--mode|--output|--sarif)=(.+)$/);
+        if (arg === "--") {
+            targetArgs.push(...commandArgs.slice(i + 1));
+            break;
+        }
+        else if (assign) {
+            const [, name, value] = assign;
+            if (name === "--baseline")
+                flags.baseline = value;
+            if (name === "--json")
+                flags.json = value;
+            if (name === "--mode")
+                flags.mode = value;
+            if (name === "--output")
+                flags.output = value;
+            if (name === "--sarif")
+                flags.sarif = value;
+        }
+        else if (arg === "--baseline") {
+            const next = commandArgs[i + 1];
+            if (!next)
+                throw new Error("--baseline requires a run artifact path.");
+            flags.baseline = next;
+            i += 1;
+        }
+        else if (arg === "--fail-on-high") {
+            flags.failOnHigh = true;
+        }
+        else if (arg === "--setup-ci") {
+            flags.setupCi = true;
+        }
+        else if (arg === "--yes") {
+            flags.yes = true;
+        }
+        else if (arg === "--no-setup-ci") {
+            flags.noSetupCi = true;
+        }
+        else if (arg === "--no-ci-sarif") {
+            flags.ciSarif = false;
+        }
+        else if (arg === "--force") {
+            flags.force = true;
+        }
+        else if (arg === "--campaign") {
+            const next = commandArgs[i + 1];
+            if (!next)
+                throw new Error("--campaign requires a campaign slug.");
+            flags.campaign = normalizeCampaign(next);
+            i += 1;
+        }
+        else if (arg === "--no-color") {
+            // Commander handles the color option; keep it out of the server command.
+        }
+        else if (arg === "--json") {
+            const next = commandArgs[i + 1];
+            if (!next)
+                throw new Error("--json requires an output file.");
+            flags.json = next;
+            i += 1;
+        }
+        else if (arg === "--mode") {
+            const next = commandArgs[i + 1];
+            if (!next)
+                throw new Error("--mode requires a value.");
+            flags.mode = next;
+            i += 1;
+        }
+        else if (arg === "--output") {
+            const next = commandArgs[i + 1];
+            if (!next)
+                throw new Error("--output requires an output file.");
+            flags.output = next;
+            i += 1;
+        }
+        else if (arg === "--sarif") {
+            const next = commandArgs[i + 1];
+            if (!next)
+                throw new Error("--sarif requires an output file.");
+            flags.sarif = next;
+            i += 1;
+        }
+        else {
+            targetArgs.push(arg);
+        }
+    }
+    return { commandArgs: targetArgs, flags };
+}
+async function readBaseline(path) {
+    if (!path)
+        return undefined;
+    return validateRunArtifact(JSON.parse(await readFile(path, "utf8")));
+}
+function reproductionCommand(options, commandArgs) {
+    const parts = ["npx @kryptosai/mcp-observatory", "attack-sim"];
+    if (options.target)
+        parts.push("--target", quoteShell(options.target));
+    if (options.baseline)
+        parts.push("--baseline", quoteShell(options.baseline));
+    if (!options.target && commandArgs.length > 0)
+        parts.push(...commandArgs.map(quoteShell));
+    return parts.join(" ");
+}
+function topAttackFindings(artifact) {
+    const severityRank = { high: 3, medium: 2, low: 1, info: 0 };
+    return extractObservatoryFindings(artifact)
+        .filter((finding) => finding.checkId === "attack-sim")
+        .sort((a, b) => severityRank[b.severity] - severityRank[a.severity])
+        .slice(0, 3);
+}
+export function registerAttackSimCommands(program) {
+    program
+        .command("attack-sim")
+        .passThroughOptions()
+        .description("Run safe MCP attack-readiness simulations for Safety Index evidence.")
+        .argument("[command...]", "Server command and arguments to run.")
+        .option("--target <config>", "Path to a target config JSON file.")
+        .option("--baseline <artifact>", "Baseline run artifact for contract drift simulation.")
+        .option("--output <file>", "Write the attack simulation Markdown report.")
+        .option("--json <file>", "Write the run artifact with attack-sim evidence.")
+        .option("--sarif <file>", "Write attack-sim findings as SARIF for GitHub Code Scanning.")
+        .option("--mode <mode>", "Simulation mode. Only 'safe' is supported.", "safe")
+        .option("--fail-on-high", "Exit nonzero when high-risk attack findings exist.", false)
+        .option("--setup-ci", "Offer CI conversion after a successful simulation; use with --yes in non-interactive runs to write files.", false)
+        .option("--yes", "Confirm CI conversion without prompting. Only writes when used with --setup-ci.", false)
+        .option("--no-setup-ci", "Suppress the post-success CI conversion prompt and hint.")
+        .option("--no-ci-sarif", "Generate post-check CI without GitHub Code Scanning SARIF upload.")
+        .option("--force", "Overwrite existing generated CI adoption files.", false)
+        .option("--campaign <slug>", "Attach a safe campaign/source slug to telemetry for attribution.")
+        .option("--no-color", "Disable colored output.")
+        .action(async (commandArgs, options) => {
+        const extracted = extractTrailingAttackFlags(commandArgs, options);
+        commandArgs = extracted.commandArgs;
+        options = extracted.flags;
+        if (options.campaign)
+            options.campaign = normalizeCampaign(options.campaign);
+        if (options.mode !== "safe") {
+            throw new Error("attack-sim supports only --mode safe.");
+        }
+        const startedAt = Date.now();
+        if (!options.target && commandArgs.length === 0) {
+            throw new Error("Provide --target <config.json> or use: mcp-observatory attack-sim <command> [args...]");
+        }
+        const target = options.target ? await resolveTarget({ target: options.target }) : targetFromCommand(commandArgs);
+        const baseline = await readBaseline(options.baseline);
+        process.stdout.write(`  ${c(ANSI.dim, "⟳")} Running safe attack simulation for ${c(ANSI.bold, target.targetId)}...`);
+        const artifact = await runTarget(target, {
+            attackSimulation: { baseline },
+            securityCheck: true,
+        });
+        const repro = reproductionCommand(options, commandArgs);
+        const attackCheck = artifact.checks.find((check) => check.id === "attack-sim");
+        const findings = topAttackFindings(artifact);
+        const highCount = extractObservatoryFindings(artifact)
+            .filter((finding) => finding.checkId === "attack-sim" && finding.severity === "high").length;
+        const icon = attackCheck?.status === "fail" ? c(ANSI.red, "✗") : attackCheck?.status === "partial" ? c(ANSI.yellow, "!") : c(ANSI.green, "✓");
+        process.stdout.write(`\r  ${icon} ${c(ANSI.bold, target.targetId)} attack-sim: ${attackCheck?.status ?? "skipped"}${" ".repeat(12)}\n`);
+        if (attackCheck) {
+            process.stdout.write(`    ${attackCheck.message}\n`);
+        }
+        for (const finding of findings) {
+            process.stdout.write(`    ${c(ANSI.dim, "→")} [${finding.severity}] ${finding.message}\n`);
+        }
+        process.stdout.write(`    ${c(ANSI.dim, "→")} ${renderActionReceipt(artifact).split("\n")[0]}\n`);
+        process.stdout.write(`\n  ${c(ANSI.bold, "Reproduce:")} ${c(ANSI.cyan, repro)}\n\n`);
+        if (options.json) {
+            await writeOutput(JSON.stringify(artifact, null, 2), "json", options.json);
+        }
+        if (options.output) {
+            await writeOutput(renderAttackSimulationMarkdown(artifact, repro), "markdown", options.output);
+        }
+        if (options.sarif) {
+            await writeOutput(renderSarif(artifact, { artifactUri: options.json }), "sarif", options.sarif);
+        }
+        recordEvent(buildEvent("command_complete", "attack-sim", "cli", {
+            targetIds: [target.targetId],
+            gateResult: attackCheck?.status ?? "skipped",
+            securityFindingCount: attackCheck?.evidence[0]?.itemCount ?? 0,
+            checkStatuses: attackCheck ? { "attack-sim": attackCheck.status } : undefined,
+            executionMs: Date.now() - startedAt,
+            campaign: options.campaign,
+        }));
+        if (artifact.gate === "pass") {
+            await maybeConvertPassingCheckToCi({
+                artifact,
+                bin: getBinName(),
+                target,
+                targetPath: options.target,
+                setupCi: options.setupCi,
+                yes: options.yes,
+                noSetupCi: options.noSetupCi,
+                ciSarif: options.ciSarif,
+                force: options.force,
+                campaign: options.campaign,
+            });
+        }
+        else if (highCount > 0) {
+            maybePrintCloudCta("security");
+        }
+        if (options.failOnHigh && highCount > 0) {
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=attack-sim.js.map

package/dist/src/commands/attack-sim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attack-sim.js","sourceRoot":"","sources":["../../../src/commands/attack-sim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9G,OAAO,EAAE,4BAA4B,EAA+B,MAAM,0BAA0B,CAAC;AAYrG,SAAS,0BAA0B,CACjC,WAAqB,EACrB,OAAyB;IAEzB,MAAM,KAAK,GAAqB,EAAE,GAAG,OAAO,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC/E,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM;QACR,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC;YAC/B,IAAI,IAAI,KAAK,YAAY;gBAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YAC1C,IAAI,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YAC1C,IAAI,IAAI,KAAK,UAAU;gBAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;YAC9C,IAAI,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACvE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACpC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YACnC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACzB,CAAC;aAAM,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YACnC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACxB,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACnE,KAAK,CAAC,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,yEAAyE;QAC3E,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAC9D,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAChE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YACpB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC/D,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAwB;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAyB,EAAE,WAAqB;IAC3E,MAAM,KAAK,GAAG,CAAC,gCAAgC,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAqB;IAC9C,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,OAAO,0BAA0B,CAAC,QAAQ,CAAC;SACxC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC;SACrD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;SACnE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,kBAAkB,EAAE;SACpB,WAAW,CAAC,sEAAsE,CAAC;SACnF,QAAQ,CAAC,cAAc,EAAE,sCAAsC,CAAC;SAChE,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;SACjE,MAAM,CAAC,uBAAuB,EAAE,sDAAsD,CAAC;SACvF,MAAM,CAAC,iBAAiB,EAAE,8CAA8C,CAAC;SACzE,MAAM,CAAC,eAAe,EAAE,kDAAkD,CAAC;SAC3E,MAAM,CAAC,gBAAgB,EAAE,8DAA8D,CAAC;SACxF,MAAM,CAAC,eAAe,EAAE,4CAA4C,EAAE,MAAM,CAAC;SAC7E,MAAM,CAAC,gBAAgB,EAAE,oDAAoD,EAAE,KAAK,CAAC;SACrF,MAAM,CAAC,YAAY,EAAE,2GAA2G,EAAE,KAAK,CAAC;SACxI,MAAM,CAAC,OAAO,EAAE,iFAAiF,EAAE,KAAK,CAAC;SACzG,MAAM,CAAC,eAAe,EAAE,0DAA0D,CAAC;SACnF,MAAM,CAAC,eAAe,EAAE,mEAAmE,CAAC;SAC5F,MAAM,CAAC,SAAS,EAAE,iDAAiD,EAAE,KAAK,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,kEAAkE,CAAC;SAC/F,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,WAAqB,EAAE,OAAyB,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,0BAA0B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACnE,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QACpC,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;QAC1B,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,uCAAuC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;YACvC,gBAAgB,EAAE,EAAE,QAAQ,EAAE;YAC9B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,0BAA0B,CAAC,QAAQ,CAAC;aACnD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAC/F,MAAM,IAAI,GAAG,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9I,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,WAAW,EAAE,MAAM,IAAI,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACxI,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAErF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,8BAA8B,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAClG,CAAC;QAED,WAAW,CAAC,UAAU,CAAC,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE;YAC9D,SAAS,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC5B,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,SAAS;YAC5C,oBAAoB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,CAAC;YAC9D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7E,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC,CAAC;QAEJ,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,4BAA4B,CAAC;gBACjC,QAAQ;gBACR,GAAG,EAAE,UAAU,EAAE;gBACjB,MAAM;gBACN,UAAU,EAAE,OAAO,CAAC,MAAM;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACzB,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/audit.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerAuditCommands(program: Command): void;

package/dist/src/commands/audit.js

@@ -0,0 +1,132 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { auditScore, renderAuditMarkdown, renderAuditSarif, resolveAuditTarget, runAudit, } from "../audit.js";
+import { buildMcpReceipt, receiptFormatFromPath, renderReceipt } from "../receipt.js";
+import { buildEvent, recordEvent } from "../telemetry.js";
+import { ANSI, c } from "./helpers.js";
+function extractTrailingAuditFlags(args, options) {
+    const targetArgs = [];
+    const nextOptions = { ...options };
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--profile") {
+            const next = args[i + 1];
+            if (!next)
+                throw new Error("--profile requires a value.");
+            nextOptions.profile = next;
+            i += 1;
+        }
+        else if (arg === "--format") {
+            const next = args[i + 1];
+            if (!next)
+                throw new Error("--format requires a value.");
+            nextOptions.format = next;
+            i += 1;
+        }
+        else if (arg === "--output") {
+            const next = args[i + 1];
+            if (!next)
+                throw new Error("--output requires a value.");
+            nextOptions.output = next;
+            i += 1;
+        }
+        else if (arg === "--receipt") {
+            const next = args[i + 1];
+            if (!next)
+                throw new Error("--receipt requires a value.");
+            nextOptions.receipt = next;
+            i += 1;
+        }
+        else if (arg === "--fail-on-high") {
+            nextOptions.failOnHigh = true;
+        }
+        else if (arg === "--fail-on-critical") {
+            nextOptions.failOnCritical = true;
+        }
+        else if (arg === "--no-color") {
+            // Commander handles color globally; keep it out of the target command.
+        }
+        else {
+            targetArgs.push(arg);
+        }
+    }
+    return { targetArgs, options: nextOptions };
+}
+async function writeMaybe(filePath, content) {
+    if (!filePath) {
+        process.stdout.write(`${content}\n`);
+        return;
+    }
+    await mkdir(path.dirname(filePath), { recursive: true });
+    await writeFile(filePath, `${content}\n`, "utf8");
+    process.stdout.write(`Wrote audit ${path.extname(filePath).slice(1) || "report"} to ${filePath}\n`);
+}
+export function registerAuditCommands(program) {
+    program
+        .command("audit")
+        .passThroughOptions()
+        .description("Run a profile-mapped MCP security audit.")
+        .argument("<target...>", "Target directory/config path or server command.")
+        .option("--profile <profile>", "Security profile to apply.", "nsa-mcp")
+        .option("--format <format>", "markdown, json, or sarif.", "markdown")
+        .option("--output <file>", "Write report to a file instead of stdout.")
+        .option("--receipt <file>", "Also write a portable MCP receipt (.json or .md).")
+        .option("--fail-on-high", "Exit nonzero when high or critical findings are present.", false)
+        .option("--fail-on-critical", "Exit nonzero when critical findings are present.", false)
+        .option("--no-color", "Disable colored output.")
+        .action(async (targetArgs, options) => {
+        const extracted = extractTrailingAuditFlags(targetArgs, options);
+        targetArgs = extracted.targetArgs;
+        options = extracted.options;
+        const startedAt = Date.now();
+        const target = await resolveAuditTarget(targetArgs);
+        if (options.output) {
+            process.stdout.write(`${c(ANSI.dim, "⟳")} Auditing ${c(ANSI.bold, target.targetId)} with profile ${c(ANSI.bold, options.profile)}...\n`);
+        }
+        const report = await runAudit(target, options.profile);
+        const format = options.format;
+        if (format === "json") {
+            await writeMaybe(options.output, JSON.stringify(report, null, 2));
+        }
+        else if (format === "sarif") {
+            await writeMaybe(options.output, renderAuditSarif(report, options.output ? path.basename(options.output).replace(/\.sarif$/i, ".json") : "mcp-observatory-audit.json"));
+        }
+        else if (format === "markdown") {
+            await writeMaybe(options.output, renderAuditMarkdown(report));
+        }
+        else {
+            throw new Error("Unsupported audit format. Use markdown, json, or sarif.");
+        }
+        if (options.receipt) {
+            const receipt = await buildMcpReceipt(report, target, {
+                commandInvoked: `mcp-observatory audit ${targetArgs.join(" ")} --profile ${options.profile} --format ${format}${options.output ? ` --output ${options.output}` : ""} --receipt ${options.receipt}`,
+                jsonReportPath: format === "json" ? options.output : undefined,
+                markdownReportPath: format === "markdown" ? options.output : undefined,
+                sarifPath: format === "sarif" ? options.output : undefined,
+            });
+            const receiptFormat = receiptFormatFromPath(options.receipt, "json");
+            await writeMaybe(options.receipt, renderReceipt(receipt, receiptFormat));
+        }
+        if (options.output) {
+            const score = auditScore(report);
+            process.stdout.write(`Trust status: ${score.status} (${score.score}/100), findings: ${score.finding_count}\n`);
+        }
+        recordEvent(buildEvent("command_complete", "audit", "cli", {
+            serversScanned: 1,
+            gateResult: report.summary.trust_status,
+            executionMs: Date.now() - startedAt,
+            securityFlag: true,
+            securityFindingCount: report.summary.finding_count,
+            targetIds: [target.targetId],
+            checkStatuses: Object.fromEntries(report.artifact.checks.map((check) => [check.id, check.status])),
+            receiptGenerated: Boolean(options.receipt),
+            receiptFormat: options.receipt ? receiptFormatFromPath(options.receipt, "json") : undefined,
+            receiptProfile: options.profile,
+        }));
+        if ((options.failOnCritical === true && report.summary.severity_counts.critical > 0) ||
+            (options.failOnHigh === true && (report.summary.severity_counts.critical > 0 || report.summary.severity_counts.high > 0))) {
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/src/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/commands/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,cAAc,CAAC;AAavC,SAAS,yBAAyB,CAAC,IAAc,EAAE,OAAqB;IACtE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,WAAW,GAAiB,EAAE,GAAG,OAAO,EAAE,CAAC;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC1D,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;YAC3B,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACzD,WAAW,CAAC,MAAM,GAAG,IAAmB,CAAC;YACzC,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACzD,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC;YAC1B,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC1D,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;YAC3B,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACpC,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC;QAChC,CAAC;aAAM,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACxC,WAAW,CAAC,cAAc,GAAG,IAAI,CAAC;QACpC,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,uEAAuE;QACzE,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAA4B,EAAE,OAAe;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,OAAO,QAAQ,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,kBAAkB,EAAE;SACpB,WAAW,CAAC,0CAA0C,CAAC;SACvD,QAAQ,CAAC,aAAa,EAAE,iDAAiD,CAAC;SAC1E,MAAM,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,SAAS,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,EAAE,UAAU,CAAC;SACpE,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;SAC/E,MAAM,CAAC,gBAAgB,EAAE,0DAA0D,EAAE,KAAK,CAAC;SAC3F,MAAM,CAAC,oBAAoB,EAAE,kDAAkD,EAAE,KAAK,CAAC;SACvF,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,UAAoB,EAAE,OAAqB,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjE,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;QAClC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3I,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC1K,CAAC;aAAM,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE;gBACpD,cAAc,EAAE,yBAAyB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,OAAO,aAAa,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,OAAO,CAAC,OAAO,EAAE;gBAClM,cAAc,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC9D,kBAAkB,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACtE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,oBAAoB,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;QACjH,CAAC;QACD,WAAW,CAAC,UAAU,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE;YACzD,cAAc,EAAE,CAAC;YACjB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;YACvC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnC,YAAY,EAAE,IAAI;YAClB,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;YAClD,SAAS,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC5B,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAClG,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1C,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,cAAc,EAAE,OAAO,CAAC,OAAO;SAChC,CAAC,CAAC,CAAC;QAEJ,IACE,CAAC,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,GAAG,CAAC,CAAC;YAChF,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EACzH,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/init-ci.d.ts

@@ -12,11 +12,14 @@ export interface InitCiOptions {
     commentOnPr?: boolean;
     setStatus?: boolean;
     sarif?: boolean;
+    schedule?: string | boolean;
     actionRef?: string;
     all?: boolean;
     force?: boolean;
     doctor?: boolean;
+    fix?: boolean;
     fromLastRun?: boolean;
+    campaign?: string;
 }
 export interface InitCiResult {
     workflowStatus: string;

package/dist/src/commands/init-ci.js

@@ -1,7 +1,8 @@
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { buildEvent, recordEvent } from "../telemetry.js";
+import { buildEvent, normalizeCampaign, recordEvent } from "../telemetry.js";
 import { defaultRunsDirectory, findLatestSuccessfulRunArtifact, readArtifact } from "../storage.js";
+import { TOOL_VERSION } from "../version.js";
 import { quoteShell } from "./helpers.js";
 const DEFAULT_WORKFLOW_PATH = ".github/workflows/mcp-observatory.yml";
 const DEFAULT_BADGE_PATH = "docs/mcp-observatory-badge.md";
@@ -9,7 +10,8 @@ const DEFAULT_TARGET_CONFIG_PATH = "mcp-observatory.target.json";
 const DEFAULT_PR_BODY_PATH = "docs/mcp-observatory-pr-body.md";
 const DEFAULT_ISSUE_BODY_PATH = "docs/mcp-observatory-issue.md";
 const DEFAULT_SCORE_BADGE_PATH = "docs/mcp-observatory-score-badge.md";
-const DEFAULT_ACTION_REF = "v0.26.1";
+const DEFAULT_ACTION_REF = `v${TOOL_VERSION}`;
+const DEFAULT_WEEKLY_CRON = "0 9 * * 1";
 async function exists(filePath) {
     try {
         await access(filePath);
@@ -19,12 +21,23 @@ async function exists(filePath) {
         return false;
     }
 }
+function normalizeSchedule(schedule) {
+    if (schedule === undefined || schedule === false)
+        return undefined;
+    if (schedule === true || schedule === "weekly")
+        return DEFAULT_WEEKLY_CRON;
+    if (schedule === "daily")
+        return "0 9 * * *";
+    const value = schedule.trim();
+    return value.length > 0 ? value : DEFAULT_WEEKLY_CRON;
+}
 function workflowYaml(options) {
     const command = options.command?.trim();
     const target = options.target?.trim();
     const commentsEnabled = options.commentOnPr === true;
     const statusEnabled = options.setStatus === true;
     const sarifEnabled = options.sarif === true;
+    const schedule = normalizeSchedule(options.schedule);
     const actionRef = options.actionRef?.trim() || DEFAULT_ACTION_REF;
     const lines = [
         "name: MCP Observatory",
@@ -33,10 +46,11 @@ function workflowYaml(options) {
         "  pull_request:",
         "  push:",
         "    branches: [main]",
-        "",
-        "permissions:",
-        "  contents: read",
     ];
+    if (schedule) {
+        lines.push("  schedule:", `    - cron: ${JSON.stringify(schedule)}`);
+    }
+    lines.push("", "permissions:", "  contents: read");
     if (commentsEnabled)
         lines.push("  pull-requests: write");
     if (statusEnabled)
@@ -206,17 +220,42 @@ function checkFile(id, label, filePath, content, expectedText) {
 }
 function setupCommand(options) {
     const sarif = options.sarif ? " --sarif" : "";
+    const schedule = normalizeSchedule(options.schedule)
+        ? ` --schedule ${quoteShell(String(options.schedule === true ? "weekly" : options.schedule))}`
+        : "";
     if (options.target)
-        return `npx @kryptosai/mcp-observatory setup-ci --all --target ${options.target}${sarif}`;
+        return `npx @kryptosai/mcp-observatory setup-ci --all --target ${options.target}${sarif}${schedule}`;
     if (options.command)
-        return `npx @kryptosai/mcp-observatory setup-ci --all --command "${options.command.replaceAll("\"", "\\\"")}"${sarif}`;
-    return `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"${sarif}`;
+        return `npx @kryptosai/mcp-observatory setup-ci --all --command "${options.command.replaceAll("\"", "\\\"")}"${sarif}${schedule}`;
+    return `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"${sarif}${schedule}`;
 }
-function initCiOptionsFromLastRunArtifact(artifact, force, sarif) {
+function initCiOptionsFromLastRunArtifact(artifact, force, sarif, schedule) {
     if (artifact.target.adapter !== "local-process")
         return undefined;
     const command = [artifact.target.command, ...artifact.target.args].map(quoteShell).join(" ");
-    return { all: true, command, force, sarif };
+    return { all: true, command, force, sarif, schedule };
+}
+function inferWorkflowTargetOptions(workflow) {
+    const target = workflow?.match(/(^|\n)\s+target:\s+(.+)/)?.[2]?.trim();
+    if (target)
+        return { target };
+    const command = workflow?.match(/(^|\n)\s+command:\s+(.+)/)?.[2]?.trim();
+    if (command)
+        return { command };
+    return {};
+}
+function doctorFixOptions(options, workflow) {
+    const inferred = options.command || options.target ? {} : inferWorkflowTargetOptions(workflow);
+    return {
+        ...options,
+        ...inferred,
+        all: true,
+        force: true,
+        sarif: true,
+        schedule: options.schedule ?? "weekly",
+        doctor: false,
+        fix: false,
+    };
 }
 export async function doctorSetupCi(options = {}) {
     const workflowPath = options.workflow ?? DEFAULT_WORKFLOW_PATH;
@@ -364,14 +403,19 @@ function addInitCiOptions(command) {
         .option("--comment-on-pr", "Allow the generated workflow to post PR comments. This adds pull-requests: write permission.", false)
         .option("--set-status", "Allow the generated workflow to set commit statuses. This adds statuses: write permission.", false)
         .option("--sarif", "Upload normalized findings to GitHub Code Scanning. This adds security-events: write permission.", false)
+        .option("--schedule [cadence]", "Also run the workflow on a schedule: weekly, daily, or a cron expression.")
         .option("--action-ref <ref>", "Git ref for KryptosAI/mcp-observatory/action. Use a full commit SHA for strict third-party action pinning.", DEFAULT_ACTION_REF)
         .option("--all", "Write the full adoption kit: workflow, badge, target config, PR body, issue body, and score badge instructions.", false)
         .option("--force", "Overwrite existing files.", false)
         .option("--doctor", "Inspect the current repository's MCP Observatory CI adoption state.", false)
-        .option("--from-last-run", "Generate the adoption kit from the latest successful local run artifact.", false);
+        .option("--fix", "With --doctor, repair the adoption kit with deep, security, SARIF, and weekly scheduled checks.", false)
+        .option("--from-last-run", "Generate the adoption kit from the latest successful local run artifact.", false)
+        .option("--campaign <slug>", "Attach a safe campaign/source slug to telemetry for attribution.");
 }
 function initCiAction(commandName) {
     return async (options) => {
+        if (options.campaign)
+            options.campaign = normalizeCampaign(options.campaign);
         if (options.doctor) {
             const result = await doctorSetupCi(options);
             process.stdout.write("MCP Observatory CI doctor\n\n");
@@ -382,14 +426,34 @@ function initCiAction(commandName) {
                     process.stdout.write(`  fix: ${check.fix}\n`);
             }
             process.stdout.write(`\nNext best action:\n  ${result.nextCommand}\n`);
-            if (!result.ready)
+            if (options.fix) {
+                const workflow = await readOptional(options.workflow ?? DEFAULT_WORKFLOW_PATH);
+                const fixed = await initCi(doctorFixOptions(options, workflow));
+                process.stdout.write("\nApplied repair:\n");
+                process.stdout.write(`${fixed.workflowStatus}: ${fixed.workflowPath}\n`);
+                if (fixed.badgePath && fixed.badgeStatus)
+                    process.stdout.write(`${fixed.badgeStatus}: ${fixed.badgePath}\n`);
+                if (fixed.targetConfigPath && fixed.targetConfigStatus)
+                    process.stdout.write(`${fixed.targetConfigStatus}: ${fixed.targetConfigPath}\n`);
+                if (fixed.prBodyPath && fixed.prBodyStatus)
+                    process.stdout.write(`${fixed.prBodyStatus}: ${fixed.prBodyPath}\n`);
+                if (fixed.issueBodyPath && fixed.issueBodyStatus)
+                    process.stdout.write(`${fixed.issueBodyStatus}: ${fixed.issueBodyPath}\n`);
+                if (fixed.scoreBadgePath && fixed.scoreBadgeStatus)
+                    process.stdout.write(`${fixed.scoreBadgeStatus}: ${fixed.scoreBadgePath}\n`);
+                process.stdout.write("\nAutomated checks: pull requests, pushes to main, and weekly scheduled runs.\n");
+            }
+            else if (!result.ready) {
                 process.exitCode = 1;
+            }
             recordEvent(buildEvent("command_complete", commandName, "cli", {
                 ciProvider: "github-actions",
                 setupCiDoctor: true,
                 setupCiReady: result.ready,
                 setupCiFailCount: result.checks.filter((check) => check.status === "fail").length,
                 setupCiWarnCount: result.checks.filter((check) => check.status === "warn").length,
+                setupCiFixApplied: options.fix === true,
+                campaign: options.campaign,
             }));
             return;
         }
@@ -405,7 +469,7 @@ function initCiAction(commandName) {
             if (artifact.artifactType !== "run") {
                 throw new Error(`Latest artifact is not a run artifact: ${latestPath}`);
             }
-            const fromRunOptions = initCiOptionsFromLastRunArtifact(artifact, options.force, options.sarif);
+            const fromRunOptions = initCiOptionsFromLastRunArtifact(artifact, options.force, options.sarif, options.schedule);
             if (!fromRunOptions) {
                 throw new Error(`Latest successful run does not contain enough target information for setup-ci: ${latestPath}`);
             }
@@ -441,6 +505,7 @@ function initCiAction(commandName) {
         recordEvent(buildEvent("command_complete", commandName, "cli", {
             ciProvider: "github-actions",
             commitStatusSet: !skipped,
+            campaign: options.campaign,
         }));
     };
 }